Why I built an app that automatically defends your Mac's network boundary

It started with a passing question about the Wi-Fi at a fast-food joint

One day, while working on public Wi-Fi, I suddenly wondered, "How does my Mac look to the person at the next table over on this Wi-Fi?" — and started digging in.

"As long as public Wi-Fi has client isolation (AP isolation), you're safe since you can't communicate with other devices" — that's what I long believed. But digging in, I found the assumption was shakier than I thought. Client isolation isn't guaranteed to be enabled on every Wi-Fi network to begin with, and even where it is, I learned it can be bypassed by a technique called "AirSnitch," reported by the SANS Institute. Running dns-sd and lsof myself was the first time it really hit home that my Mac was broadcasting plenty of information in plaintext over Bonjour (mDNS).

The conclusion I reached was simple: there are only two real countermeasures — "reduce the exposed surface" and building on the assumption that "a human won't manually switch settings every time the network changes." Almost nobody re-checks their settings every time they arrive at a café (I don't either). So I figured what's needed is a mechanism that automatically distinguishes trusted networks from everything else and quietly narrows the exposed surface on unfamiliar ones — and building that into a macOS app to automate it is how RoamSwitch began.

Dev servers, it turned out, had the same problem

Following on from investigating public Wi-Fi, I got curious about "what about dev servers, then" and dug in. I'd vaguely assumed "dev servers only listen on localhost, so they're safe from outside" — but this too turned out to vary wildly by framework, with some defaults working against intuition.

next dev binds to 0.0.0.0 unless you specify a hostname, and python -m http.server similarly defaults to exposing every interface. Vite is comparatively sane, defaulting to localhost — but everyone's probably added --host at some point to test on a real phone, and CVE-2023-34092 (a path-traversal bug, CVSS 7.5) exists that targets exactly that case. Docker's -p option goes so far as to publish on 0.0.0.0 even in ways that slip past the host's own firewall settings.

In the end, this led to the same conclusion. Rather than relying on a human to remember to close things down, a mechanism that automatically blocks external access the instant you connect to an untrusted network is more realistic. This has become one of RoamSwitch's most commonly reported use cases in practice — passively auditing open ports to report the risk, while blocking access from the external LAN via the kernel's packet filter on unregistered networks.

The technical foundation behind RoamSwitch's firewall control (pf/socketfilterfw), ARP spoofing detection, and safe privilege separation via a privileged helper (XPC) is backed by hands-on experience as a systems engineer at a foreign-affiliated IT company and a major electronics manufacturer group, and later by knowledge of OS/networking fundamentals, operational automation, incident response, and security management gained while running an independent ASP service for government agencies, universities, and research institutions. Areas of interest include low-level Linux, network defense, machine learning, high-performance data infrastructure, and system design. Currently working as an independent developer in the AI/machine learning space while building and maintaining RoamSwitch, an app that automates Mac network security. Findings are published as technical articles on Zenn.